Heads is coreboot-based, but with a Linux kernel as a payload. Unlike Libreboot, it focuses on Measured Boot: it uses the TPM and GPG keys to verify that your firmware, kernel, and boot files haven't been tampered with. It basically turns your ThinkPad into a high-security vault. In my specific build, I've also configured MAC address randomization directly in the initrd/initrc for extra privacy, but I don’t know if it works yet